← All artifacts

Keychain

macOS Keychain metadata including generic passwords, internet passwords, certificates, and cryptographic keys — without exposing secret data.

Status
available
CLI plugin
system.keychain
Categories
security, system

Overview

The Keychain collector extracts metadata from macOS keychain databases, covering generic passwords, internet passwords, certificates, and cryptographic keys. Only metadata columns are collected — the data column containing actual secrets is never extracted, ensuring forensically sound collection without exposing credentials.

Analysis Tips

  • Internet passwords: The inet table includes server (srvr), protocol (ptcl), port, and path — useful for identifying accessed services
  • Protocol decoding: The ptcl column is a 4-byte big-endian ASCII integer (e.g., 0x68747073 = htps = HTTPS)
  • Protection domains: pdmn codes indicate access control (ak = WhenUnlocked, ck = AfterFirstUnlock)
  • BLOB handling: Many columns store raw byte BLOBs that must be validated as UTF-8 with base64 fallback
  • iCloud sync: accountStatus.plist reveals whether iCloud Keychain is enabled, indicating cross-device credential sharing
  • Certificate analysis: Subject, issuer, serial number, and key hash enable trust chain analysis

Related Artifacts

References

Data sources

keychain-2.dbSQLite

~/Library/Keychains/{UUID}/

Data Protection keychain — generic and internet passwords, certificates, keys

login.keychain-dbSQLite

~/Library/Keychains/

Login keychain (same table structure)

System.keychainSQLite

/Library/Keychains/

System keychain (requires root)

accountStatus.plistBinary Plist

~/Library/Keychains/

iCloud Keychain sync state